From b80437b78c53eefb5475cf6e979146bc79353ce4 Mon Sep 17 00:00:00 2001 From: soharab-ic <156293296+soharab-ic@users.noreply.github.com> Date: Mon, 2 Sep 2024 11:06:55 +0530 Subject: [PATCH] Configure user ID for logger container's securityContext using helm values.yaml (#3005) * Run logger as root to allow access to log files from host * Add to connect part of yaml * Change fission folder to allow non-root to write into folder instead * Configure user ID for logger from helm values.yaml Signed-off-by: Md Soharab Ansari --------- Signed-off-by: Md Soharab Ansari Co-authored-by: Mark Retallack --- .../templates/fluentbit/fluentbit.yaml | 4 +--- charts/fission-all/values.yaml | 15 +++++++++++++-- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/charts/fission-all/templates/fluentbit/fluentbit.yaml b/charts/fission-all/templates/fluentbit/fluentbit.yaml index f54a400f..9718fe97 100644 --- a/charts/fission-all/templates/fluentbit/fluentbit.yaml +++ b/charts/fission-all/templates/fluentbit/fluentbit.yaml @@ -128,10 +128,8 @@ spec: - name: docker-log mountPath: /var/lib/docker/containers readOnly: true -{{- if .Values.logger.enableSecurityContext }} securityContext: - privileged: true -{{- end }} + {{- toYaml .Values.logger.securityContext | nindent 12 }} - name: fluentbit {{- if .Values.repository }} image: "{{ .Values.logger.fluentdImageRepository }}/{{ .Values.logger.fluentdImage }}:{{ .Values.logger.fluentdImageTag }}" diff --git a/charts/fission-all/values.yaml b/charts/fission-all/values.yaml index f0b668f8..8225725f 100644 --- a/charts/fission-all/values.yaml +++ b/charts/fission-all/values.yaml @@ -620,11 +620,22 @@ logger: ## Fluent-bit writes/reads it’s own sqlite database to record a history of tracked ## files and a state of offsets, this is very useful to resume a state if the ser- - ## vice is restarted. For Kubernetes environment with constraints like OpenShift, + ## vice is restarted. + ## + ## For Kubernetes environment with constraints like OpenShift, ## the containers are limited to write hostPath volume. Hence, we have to enable ## security context and set privileged to true. ## - enableSecurityContext: false + ## The user ID in runAsUser should have access to the `/var/log` and + ## `/var/lib/docker/containers` directories on your host. + ## On many hosts, this user might be root ,i.e., `runAsUser: 0`. + ## Although it is recommended not to use root user for security reasons. + ## + ## The `/var/log` and `/var/lib/docker/containers` directories on host are mounted + ## to logger container with volumeType `HostPath`. + securityContext: {} + # privileged: true + # runAsUser: 0 ## Enable PodSecurityPolicies to allow privileged container ## Only required in some clusters and when enableSecurityContext is true